sslbrain vs TrustView and TrustView Lite

Short answer

TrustView from TrustSkills runs on-prem at the customer's site. TrustView Lite is a SaaS edition for small and medium-sized organisations with at most 3 users.^1,2,3 TrustView automates with the customer's own ACME and SCEP clients and pushes to Citrix NetScaler and Azure itself. Automation requires the Automation module.⁴ TrustSkills is a Danish company in Aarhus, acquired by Cryptomathic. Prices are not public and require a sales conversation.^5,6,7,2

sslbrain runs as an appliance in your own network. The catalogue has 72 integrations. On Windows and Linux servers, a service agent installs the certificate. To network equipment and cloud services, the appliance pushes over API or SSH. Where there is no integration, you use a custom agent or ACME.

How to read the table

Every answer about another vendor carries a small number. It leads to the source at the foot of the page, with the date the source was last checked.
"Not stated" means it does not appear in the sources we reviewed. It does not mean no.
Prices are in the vendor's own currency, not converted. Where only the yearly or the monthly price is stated, the other is calculated and marked.
The sslbrain column has no source numbers. It comes from our own prices and our integration catalogue and links to those pages.

Every edition of TrustView and sslbrain

The table scrolls sideways.

Question	sslbrain	TrustView	TrustView Lite
Price
Price per year and per month	Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint. See the prices	Not public, requires a sales conversation⁷	Not public, requires a sales conversation²
Automation
How the certificate gets there	Both agents/push and ACME Full answer a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.	Both agents/push and ACME⁴ Full answer the customer's own ACME/SCEP clients as "automation agents" plus TrustView's own push to Citrix NetScaler and Azure; no deployment agents of its own; automation requires the Automation module	ACME/SCEP only³ Full answer ACME/SCEP with the Automation module; the feature table also mentions integrated Citrix ADC and Microsoft Azure installation without describing the mechanism, so push is not stated (Cryptomathic's page only; TrustSkills' own Lite page mentions no automation)
Direct agents and connectors	72 integrations in the catalogue See the integrations	2⁴ Full answer native integrations; the ACME/SCEP server is not counted	2³ Full answer integrated installations in Cryptomathic's feature table
Without a direct agent	Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME	The customer's own ACME client (simple-acme, Certbot) or SCEP client, possibly with scripts^8,4 Full answer docs have example scripts	ACME or SCEP client (requires the Automation module)³
Named systems
FortiGate	Yes Full answer Fortinet FortiGate: push from the appliance over the API, port 443	Not stated	Not stated
F5 BIG-IP	Yes Full answer F5 BIG-IP: push from the appliance over the API, port 443	Yes⁴ Full answer the customer's Certbot with the certbot-bigip plugin on a separate Linux machine	Not stated
NetScaler	Yes Full answer Citrix NetScaler / ADC: push from the appliance over the API, port 443	Yes⁹ Full answer push from TrustView via API and SSH	Yes³ Full answer integrated installation, requires the Automation module
SonicWall	Yes Full answer SonicWall SonicOS: push from the appliance over the API, port 443	Not stated	Not stated
Palo Alto	Yes Full answer Palo Alto Networks PAN-OS: push from the appliance over the API, port 443	Yes⁴ Full answer the customer's Certbot with a pan-python script on a separate Linux machine	Not stated
Check Point	Yes Full answer Check Point HTTPS Inspection: push from the appliance over the API, port 443	Not stated	Not stated
Kemp LoadMaster	Yes Full answer Kemp LoadMaster: push from the appliance over the API, port 443	Not stated	Not stated
Cisco	Yes Full answer Cisco Secure Firewall (FDM): push from the appliance over the API, port 443	Not stated	Not stated
IIS	Yes Full answer Microsoft IIS: service agent on the server	Yes⁴ Full answer the customer's simple-acme on the Windows server	Not stated
Exchange	Yes Full answer Microsoft Exchange: service agent on the server	Yes¹⁰ Full answer ACME client; mentioned in the module description, no guidance in the docs	Not stated
nginx and Apache	Yes Full answer Nginx: service agent on the server; Apache HTTP Server: service agent on the server	Yes^4,10 Full answer Apache: the customer's Certbot on the Linux server; Nginx: mentioned among the applications that are automated, without a described mechanism	Not stated
Tomcat (JKS)	Yes Full answer Apache Tomcat: service agent on the server	Yes⁴ Full answer the customer's simple-acme or Certbot plus a script	Not stated
Azure Key Vault	Yes Full answer Azure Key Vault: push from the appliance over the API, port 443	Yes^11,4 Full answer push from TrustView via the Azure integration; alternatively simple-acme with the keyvault plugin	Not stated
AWS Certificate Manager	Yes Full answer AWS Certificate Manager: push from the appliance over the API, port 443	Not stated	Not stated
Push without an agent
Push with no software on the destination	50 destinations Show the list Akamai CPS (push from the appliance over the API, port 443) Aruba/HPE ClearPass (push from the appliance over the API, port 443) AWS Certificate Manager (push from the appliance over the API, port 443) AWS CloudFront (push from the appliance over the API, port 443) AWS ELB & API Gateway (push from the appliance over the API, port 443) Azure App Service (push from the appliance over the API, port 443) Azure Application Gateway (push from the appliance over the API, port 443) Azure Front Door (push from the appliance over the API, port 443) Azure Key Vault (push from the appliance over the API, port 443) Barracuda CloudGen Firewall (push from the appliance over the API, port 8443) Barracuda Web Application Firewall (push from the appliance over the API, port 8443) Bunny.net CDN (push from the appliance over the API, port 443) Check Point HTTPS Inspection (push from the appliance over the API, port 443) Cisco ASA / ASAv (push from the appliance over SSH, port 22) Cisco ISE (push from the appliance over the API, port 443) Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443) Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443) Citrix NetScaler / ADC (push from the appliance over the API, port 443) Cloudflare (push from the appliance over the API, port 443) Dell iDRAC (push from the appliance over the API, port 443) F5 BIG-IP (push from the appliance over the API, port 443) Fortinet FortiADC (push from the appliance over the API, port 443) Fortinet FortiGate (push from the appliance over the API, port 443) Fortinet FortiMail (push from the appliance over SSH, port 22) Fortinet FortiManager (push from the appliance over the API, port 443) Fortinet FortiNAC (push from the appliance over the API, port 8443) Fortinet FortiWeb WAF (push from the appliance over the API, port 443) Google Cloud Certificate Manager (push from the appliance over the API, port 443) HPE iLO (push from the appliance over the API, port 443) Infoblox NIOS Grid Manager (push from the appliance over the API, port 443) Ivanti Connect Secure (push from the appliance over the API, port 443) Juniper SRX / vSRX (push from the appliance over SSH, port 22) Kemp LoadMaster (push from the appliance over the API, port 443) Kubernetes (push from the appliance over the API, port 6443) NetApp ONTAP (push from the appliance over the API, port 443) OPNsense (push from the appliance over the API, port 443) Palo Alto Networks PAN-OS (push from the appliance over the API, port 443) pfSense (push from the appliance over SSH, port 22) Proxmox Backup Server (push from the appliance over the API, port 8007) Proxmox Mail Gateway (push from the appliance over the API, port 8006) Proxmox VE (push from the appliance over the API, port 8006) SonicWall SonicOS (push from the appliance over the API, port 443) Sophos Firewall (push from the appliance over the API, port 4444) Synology DSM (push from the appliance over the API, port 5001) TrueNAS SCALE / CORE (push from the appliance over the API, port 443) Ubiquiti UniFi (push from the appliance over SSH, port 22) VMware Avi / NSX ALB (push from the appliance over the API, port 443) VMware ESXi (push from the appliance over SSH, port 22) VMware vCenter (push from the appliance over the API, port 443) WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443) See the integrations	2 destinations Show the list Citrix NetScaler (API and SSH from the TrustView server)⁹ Azure Key Vault (Azure APIs from the TrustView server)^11,12 What the list covers: From the Automation section of the docs (Automation, Citrix NetScaler, Azure Integration, DNS Integration, ADFS Services) and the feature table; the vendor has no separate integration list. F5 and Palo Alto via the customer’s Certbot on a separate Linux machine do not count as TrustView push⁸	Not stated
Private keys
Where the private key is kept	On-prem appliance See the architecture	On-prem at the customer¹³ The destination⁴	The destination³
Network
Servers with an agent or ACME	The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports	The ACME client on the server initiates the connection to the TrustView instance’s ACME URL⁴ Full answer The SCEP client’s connection is not described. Automation requires HTTPS 443 inbound and outbound as well as outbound 443 to view.trustskills.com and api.trustskills.com. Whether 443 must be reachable from the internet is not stated	Not stated
Equipment without an agent	The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet	The TrustView server pushes: to NetScaler via API and SSH (port 22 must be open)⁹ Full answer to Azure via Azure APIs (port number not specified for Azure)	Not stated
Windows and Linux
Windows	Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports	The customer’s simple-acme (or win-acme) on the server retrieves the certificate from TrustView over HTTPS 443 and binds it in IIS/cert store⁴	Not stated
Linux	Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports	The customer’s Certbot on the server retrieves the certificate from TrustView over HTTPS 443⁴ Full answer deploy-hooks/scripts install it	Not stated
Branch offices
Remote sites and branch offices	One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports	External scan agents (discovery only) can be installed on Windows/Linux servers elsewhere in the network and must be able to reach the TrustView URL¹⁴ Full answer ACME clients at a site must reach the TrustView instance’s ACME URL. Gateway or VPN requirements for sites without a connection are not stated	Scan agent for internal certificates (discovery and monitoring only)² Full answer automation at sites without a connection is not stated
Vendor and EU
Vendor	FairSSL A/S, Denmark	TrustSkills A/S, Aarhus, Denmark (CVR 35467955)^5,6 Full answer acquired by Danish Cryptomathic (announced 21-05-2026)	TrustSkills A/S, Aarhus, Denmark (CVR 35467955)^5,6 Full answer acquired by Danish Cryptomathic (announced 21-05-2026)
Hosting and the EU	EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud) See the infrastructure	On-prem: server (Windows Server 2022 or later) and database at the customer¹ Full answer TrustView connects outbound to api.trustskills.com, whose hosting country is not stated	Not stated

sslbrain

Price

Price per year and per month: Free: 5 endpoints and 10 certificates (up to 100 names in each). Paid from €2.990/year, public price per endpoint.

See the prices

Automation

How the certificate gets there: Both agents/push and ACME

Full answer

a service agent on Windows and Linux servers. Push from the appliance to network equipment and cloud services over API or SSH.
Direct agents and connectors: 72 integrations in the catalogue

See the integrations
Without a direct agent: Custom agent with your own script (PowerShell, bash or Python), signed by the appliance; or ACME

Named systems

FortiGate: Yes

Full answer

Fortinet FortiGate: push from the appliance over the API, port 443
F5 BIG-IP: Yes

Full answer

F5 BIG-IP: push from the appliance over the API, port 443
NetScaler: Yes

Full answer

Citrix NetScaler / ADC: push from the appliance over the API, port 443
SonicWall: Yes

Full answer

SonicWall SonicOS: push from the appliance over the API, port 443
Palo Alto: Yes

Full answer

Palo Alto Networks PAN-OS: push from the appliance over the API, port 443
Check Point: Yes

Full answer

Check Point HTTPS Inspection: push from the appliance over the API, port 443
Kemp LoadMaster: Yes

Full answer

Kemp LoadMaster: push from the appliance over the API, port 443
Cisco: Yes

Full answer

Cisco Secure Firewall (FDM): push from the appliance over the API, port 443
IIS: Yes

Full answer

Microsoft IIS: service agent on the server
Exchange: Yes

Full answer

Microsoft Exchange: service agent on the server
nginx and Apache: Yes

Full answer

Nginx: service agent on the server; Apache HTTP Server: service agent on the server
Tomcat (JKS): Yes

Full answer

Apache Tomcat: service agent on the server
Azure Key Vault: Yes

Full answer

Azure Key Vault: push from the appliance over the API, port 443
AWS Certificate Manager: Yes

Full answer

AWS Certificate Manager: push from the appliance over the API, port 443

Push without an agent

Push with no software on the destination: 50 destinations

Show the list

Akamai CPS (push from the appliance over the API, port 443)
Aruba/HPE ClearPass (push from the appliance over the API, port 443)
AWS Certificate Manager (push from the appliance over the API, port 443)
AWS CloudFront (push from the appliance over the API, port 443)
AWS ELB & API Gateway (push from the appliance over the API, port 443)
Azure App Service (push from the appliance over the API, port 443)
Azure Application Gateway (push from the appliance over the API, port 443)
Azure Front Door (push from the appliance over the API, port 443)
Azure Key Vault (push from the appliance over the API, port 443)
Barracuda CloudGen Firewall (push from the appliance over the API, port 8443)
Barracuda Web Application Firewall (push from the appliance over the API, port 8443)
Bunny.net CDN (push from the appliance over the API, port 443)
Check Point HTTPS Inspection (push from the appliance over the API, port 443)
Cisco ASA / ASAv (push from the appliance over SSH, port 22)
Cisco ISE (push from the appliance over the API, port 443)
Cisco Secure Firewall (FDM) (push from the appliance over the API, port 443)
Cisco Secure Firewall (FMC) (push from the appliance over the API, port 443)
Citrix NetScaler / ADC (push from the appliance over the API, port 443)
Cloudflare (push from the appliance over the API, port 443)
Dell iDRAC (push from the appliance over the API, port 443)
F5 BIG-IP (push from the appliance over the API, port 443)
Fortinet FortiADC (push from the appliance over the API, port 443)
Fortinet FortiGate (push from the appliance over the API, port 443)
Fortinet FortiMail (push from the appliance over SSH, port 22)
Fortinet FortiManager (push from the appliance over the API, port 443)
Fortinet FortiNAC (push from the appliance over the API, port 8443)
Fortinet FortiWeb WAF (push from the appliance over the API, port 443)
Google Cloud Certificate Manager (push from the appliance over the API, port 443)
HPE iLO (push from the appliance over the API, port 443)
Infoblox NIOS Grid Manager (push from the appliance over the API, port 443)
Ivanti Connect Secure (push from the appliance over the API, port 443)
Juniper SRX / vSRX (push from the appliance over SSH, port 22)
Kemp LoadMaster (push from the appliance over the API, port 443)
Kubernetes (push from the appliance over the API, port 6443)
NetApp ONTAP (push from the appliance over the API, port 443)
OPNsense (push from the appliance over the API, port 443)
Palo Alto Networks PAN-OS (push from the appliance over the API, port 443)
pfSense (push from the appliance over SSH, port 22)
Proxmox Backup Server (push from the appliance over the API, port 8007)
Proxmox Mail Gateway (push from the appliance over the API, port 8006)
Proxmox VE (push from the appliance over the API, port 8006)
SonicWall SonicOS (push from the appliance over the API, port 443)
Sophos Firewall (push from the appliance over the API, port 4444)
Synology DSM (push from the appliance over the API, port 5001)
TrueNAS SCALE / CORE (push from the appliance over the API, port 443)
Ubiquiti UniFi (push from the appliance over SSH, port 22)
VMware Avi / NSX ALB (push from the appliance over the API, port 443)
VMware ESXi (push from the appliance over SSH, port 22)
VMware vCenter (push from the appliance over the API, port 443)
WatchGuard Firebox (Local: SSH 4118 · Cloud: HTTPS 443)

See the integrations

Private keys

Where the private key is kept: On-prem appliance

See the architecture

Network

Servers with an agent or ACME: The service agent opens the connection: outbound HTTPS to the appliance (port 443) or through sslbrain Cloud; no inbound ports
Equipment without an agent: The appliance connects to the device API or SSH (ports in the catalogue: 22, 443, 4118, 4444, 5001, 6443, 8006, 8007, 8443); nothing is installed on the device; no inbound ports from the internet

Windows and Linux

Windows: Service agent on the server (IIS, Exchange, RDP, SQL Server); outbound HTTPS 443 to the appliance or through sslbrain Cloud; no inbound ports
Linux: Service agent on the server (nginx, Apache, Postfix); outbound HTTPS 443; no inbound ports

Branch offices

Remote sites and branch offices: One service agent per network (branch, DMZ, data centre) through sslbrain Cloud, outbound 443; no VPN and no inbound ports

Vendor and EU

Vendor: FairSSL A/S, Denmark
Hosting and the EU: EU: sslbrain Cloud and database in Copenhagen, key vault in Copenhagen, Stockholm and Amsterdam, backup in Helsinki (UpCloud)

See the infrastructure

TrustView

Price

Price per year and per month: Not public, requires a sales conversation⁷

Automation

How the certificate gets there: Both agents/push and ACME⁴

Full answer

the customer's own ACME/SCEP clients as "automation agents" plus TrustView's own push to Citrix NetScaler and Azure; no deployment agents of its own; automation requires the Automation module
Direct agents and connectors: 2⁴

Full answer

native integrations; the ACME/SCEP server is not counted
Without a direct agent: The customer's own ACME client (simple-acme, Certbot) or SCEP client, possibly with scripts^8,4

Full answer

docs have example scripts

Named systems

FortiGate: Not stated
F5 BIG-IP: Yes⁴

Full answer

the customer's Certbot with the certbot-bigip plugin on a separate Linux machine
NetScaler: Yes⁹

Full answer

push from TrustView via API and SSH
SonicWall: Not stated
Palo Alto: Yes⁴

Full answer

the customer's Certbot with a pan-python script on a separate Linux machine
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Yes⁴

Full answer

the customer's simple-acme on the Windows server
Exchange: Yes¹⁰

Full answer

ACME client; mentioned in the module description, no guidance in the docs
nginx and Apache: Yes^4,10

Full answer

Apache: the customer's Certbot on the Linux server; Nginx: mentioned among the applications that are automated, without a described mechanism
Tomcat (JKS): Yes⁴

Full answer

the customer's simple-acme or Certbot plus a script
Azure Key Vault: Yes^11,4

Full answer

push from TrustView via the Azure integration; alternatively simple-acme with the keyvault plugin
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: 2 destinations

Show the list

Citrix NetScaler (API and SSH from the TrustView server)⁹
Azure Key Vault (Azure APIs from the TrustView server)^11,12

What the list covers: From the Automation section of the docs (Automation, Citrix NetScaler, Azure Integration, DNS Integration, ADFS Services) and the feature table; the vendor has no separate integration list. F5 and Palo Alto via the customer’s Certbot on a separate Linux machine do not count as TrustView push⁸

Private keys

Where the private key is kept: On-prem at the customer¹³
The destination⁴

Network

Servers with an agent or ACME: The ACME client on the server initiates the connection to the TrustView instance’s ACME URL⁴

Full answer

The SCEP client’s connection is not described. Automation requires HTTPS 443 inbound and outbound as well as outbound 443 to view.trustskills.com and api.trustskills.com. Whether 443 must be reachable from the internet is not stated
Equipment without an agent: The TrustView server pushes: to NetScaler via API and SSH (port 22 must be open)⁹

Full answer

to Azure via Azure APIs (port number not specified for Azure)

Windows and Linux

Windows: The customer’s simple-acme (or win-acme) on the server retrieves the certificate from TrustView over HTTPS 443 and binds it in IIS/cert store⁴
Linux: The customer’s Certbot on the server retrieves the certificate from TrustView over HTTPS 443⁴

Full answer

deploy-hooks/scripts install it

Branch offices

Remote sites and branch offices: External scan agents (discovery only) can be installed on Windows/Linux servers elsewhere in the network and must be able to reach the TrustView URL¹⁴

Full answer

ACME clients at a site must reach the TrustView instance’s ACME URL. Gateway or VPN requirements for sites without a connection are not stated

Vendor and EU

Vendor: TrustSkills A/S, Aarhus, Denmark (CVR 35467955)^5,6

Full answer

acquired by Danish Cryptomathic (announced 21-05-2026)
Hosting and the EU: On-prem: server (Windows Server 2022 or later) and database at the customer¹

Full answer

TrustView connects outbound to api.trustskills.com, whose hosting country is not stated

TrustView Lite

Price

Price per year and per month: Not public, requires a sales conversation²

Automation

How the certificate gets there: ACME/SCEP only³

Full answer

ACME/SCEP with the Automation module; the feature table also mentions integrated Citrix ADC and Microsoft Azure installation without describing the mechanism, so push is not stated (Cryptomathic's page only; TrustSkills' own Lite page mentions no automation)
Direct agents and connectors: 2³

Full answer

integrated installations in Cryptomathic's feature table
Without a direct agent: ACME or SCEP client (requires the Automation module)³

Named systems

FortiGate: Not stated
F5 BIG-IP: Not stated
NetScaler: Yes³

Full answer

integrated installation, requires the Automation module
SonicWall: Not stated
Palo Alto: Not stated
Check Point: Not stated
Kemp LoadMaster: Not stated
Cisco: Not stated
IIS: Not stated
Exchange: Not stated
nginx and Apache: Not stated
Tomcat (JKS): Not stated
Azure Key Vault: Not stated
AWS Certificate Manager: Not stated

Push without an agent

Push with no software on the destination: Not stated

Private keys

Where the private key is kept: The destination³

Network

Servers with an agent or ACME: Not stated
Equipment without an agent: Not stated

Windows and Linux

Windows: Not stated
Linux: Not stated

Branch offices

Remote sites and branch offices: Scan agent for internal certificates (discovery and monitoring only)²

Full answer

automation at sites without a connection is not stated

Vendor and EU

Vendor: TrustSkills A/S, Aarhus, Denmark (CVR 35467955)^5,6

Full answer

acquired by Danish Cryptomathic (announced 21-05-2026)
Hosting and the EU: Not stated

When TrustView fits better

You want a SaaS service for monitoring and expiry alerts for up to 3 users (TrustView Lite).^2,3
Your servers already have ACME or SCEP clients, and you want to manage them from a platform on your own network with TrustView's Automation module.^4,14,1

Sources

1. 7. Installation Prerequisites (docs.trustskills.com), checked 11-10-2026
2. TrustView Lite (trustskills.com), checked 11-10-2026
3. TrustView Lite (cryptomathic.com), checked 11-10-2026
4. 1. Automation (docs.trustskills.com), checked 11-10-2026
5. Privacy and cookie policy (trustskills.com), checked 11-10-2026
6. Riverside Builds Cryptomathic with TrustSkills Add-on (cryptomathic.com), checked 11-10-2026
7. TrustView Automation (trustskills.com), checked 11-10-2026
8. TrustView (trustskills.com), checked 11-10-2026
9. 2. Citrix NetScaler (docs.trustskills.com), checked 11-10-2026
10. 1. Introduction (docs.trustskills.com), checked 11-10-2026
11. TrustView (cryptomathic.com), checked 11-10-2026
12. 3. Azure Integration (docs.trustskills.com), checked 11-10-2026
13. 3. Ordering SSL Certificates (docs.trustskills.com), checked 11-10-2026
14. 2. Scan Agents (docs.trustskills.com), checked 11-10-2026

If you see an error about another vendor, write to us. We correct it and update the check date. Write to us

Try sslbrain

Start free. No credit card required.

Download sslbrain See the prices